製品・ソフトウェアに関する情報

JVN脆弱性詳細

Oracle Java SE における Deployment に関する脆弱性

Title	Oracle Java SE における Deployment に関する脆弱性
Summary	Oracle Java SE には、Deployment に関する処理に不備があるため、機密性、完全性、および可用性に影響のある脆弱性が存在します。本脆弱性は、CVE-2013-5889、CVE-2013-5902、CVE-2014-0410、CVE-2014-0415 および CVE-2014-0418 とは異なる脆弱性です。
Possible impacts	第三者により、情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 14, 2014, midnight
Registration Date	Jan. 17, 2014, 5:17 p.m.
Last Update	March 17, 2015, 5:38 p.m.

CVSS2.0 : 危険
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected System

レッドハット

Red Hat Enterprise Linux (v. 5 server)

Red Hat Enterprise Linux Desktop (v. 5 client)

Red Hat Enterprise Linux Desktop (v. 6)

Red Hat Enterprise Linux Desktop Supplementary (v. 6)

Red Hat Enterprise Linux HPC Node (v. 6)

Red Hat Enterprise Linux HPC Node Supplementary (v. 6)

Red Hat Enterprise Linux Server (v. 6)

Red Hat Enterprise Linux Server AUS (v. 6.5)

Red Hat Enterprise Linux Server EUS (v. 6.5.z)

Red Hat Enterprise Linux Server Supplementary (v. 6)

Red Hat Enterprise Linux Server Supplementary AUS (v. 6.5)

Red Hat Enterprise Linux Server Supplementary EUS (v. 6.5.z)

Red Hat Enterprise Linux Workstation (v. 6)

Red Hat Enterprise Linux Workstation Supplementary (v. 6)

RHEL Desktop Supplementary (v. 5 client)

RHEL Supplementary (v. 5 server)

オラクル

JDK 6 Update 65 およびそれ以前

JDK 7 Update 45 およびそれ以前

JRE 6 Update 65 およびそれ以前

JRE 7 Update 45 およびそれ以前

日立

Cosminexus Application Server Version 5

Cosminexus Application Server Enterprise Version 6

Cosminexus Application Server Standard Version 6

Cosminexus Client Version 6

Cosminexus Developer Light Version 6

Cosminexus Developer Professional Version 6

Cosminexus Developer Standard Version 6

Cosminexus Developer Version 5

Cosminexus Developer's Kit for Java(TM)

Cosminexus Primary Server Base

Cosminexus Studio Version 5

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Light

uCosminexus Application Server Standard-R

uCosminexus Application Server Enterprise

uCosminexus Application Server Smart Edition

uCosminexus Application Server Standard

uCosminexus Client

uCosminexus Client for Plug-in

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer Light

uCosminexus Developer Standard

uCosminexus Operator

uCosminexus Primary Server Base

uCosminexus Server Standard-R

uCosminexus Service Architect

uCosminexus Service Platform

uCosminexus Service Platform - Messaging

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0424	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424
National Vulnerability Database (NVD)
2	CVE-2014-0424	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0424

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Hitachi Software Vulnerability Information
1	HS14-004	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-004/index.html
HP Security Bulletin
2	HPSBUX02972 SSRT101454	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04166777
3	HPSBUX02973 SSRT101455	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04166778
IBM Support Document
4	1659761	http://www-01.ibm.com/support/docview.wss?uid=swg21659761
5	1662968	http://www-01.ibm.com/support/docview.wss?uid=swg21662968
6	1663938	http://www-01.ibm.com/support/docview.wss?uid=swg21663938
7	1664835	http://www-01.ibm.com/support/docview.wss?uid=swg21664835
8	1667143	http://www-01.ibm.com/support/docview.wss?uid=swg21667143
9	1669498	http://www-01.ibm.com/support/docview.wss?uid=swg21669498
10	1670264	http://www-01.ibm.com/support/docview.wss?uid=swg21670264
11	1670805	http://www-01.ibm.com/support/docview.wss?uid=swg21670805
12	1671348	http://www-01.ibm.com/support/docview.wss?uid=swg21671348
13	1672078	http://www-01.ibm.com/support/docview.wss?uid=swg21672078
14	1672835	http://www-01.ibm.com/support/docview.wss?uid=swg21672835
15	1673091	http://www-01.ibm.com/support/docview.wss?uid=swg21673091
16	1675205	http://www-01.ibm.com/support/docview.wss?uid=swg21675205
17	1675223	http://www-01.ibm.com/support/docview.wss?uid=swg21675223
18	N1020003	http://www.ibm.com/support/docview.wss?uid=nas8N1020003
IBM セキュリティー情報
19	1671008	http://www-01.ibm.com/support/docview.wss?uid=swg21671008
20	1672384	http://www-01.ibm.com/support/docview.wss?uid=swg21672384
Oracle Critical Patch Update
21	Oracle Critical Patch Update Advisory - January 2014	http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
22	Text Form of Oracle Critical Patch Update - January 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2014verbose-1972951.html
Red Hat Bugzilla
23	Bug 1053504	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0424
Red Hat Security Advisory
24	RHSA-2014:0030	https://rhn.redhat.com/errata/RHSA-2014-0030.html
25	RHSA-2014:0134	http://rhn.redhat.com/errata/RHSA-2014-0134.html
26	RHSA-2014:0135	https://rhn.redhat.com/errata/RHSA-2014-0135.html
SECURITY BLOG
27	January 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2014_critical_patch_update
ソフトウェア製品セキュリティ情報
28	HS14-004	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-004/index.html
富士通セキュリティ情報
29	Oracle Corporation Javaプラグインの脆弱性に関するお知らせ	http://www.fmworld.net/biz/common/oracle/20140116.html

その他

No	Name	URL
IPA 重要なセキュリティ情報
1	Oracle Java の脆弱性対策について(CVE-2014-0410等)	http://www.ipa.go.jp/security/ciadr/vul/20140115-jre.html
JPCERT 注意喚起
2	JPCERT-AT-2014-0002	http://www.jpcert.or.jp/at/2014/at140002.html

Change Log

No	Changed Details	Date of change
0	[2014年01月17日] 掲載 [2014年01月30日] ベンダ情報：日立 (HS14-004) を追加ベンダ情報：レッドハット (RHSA-2014:0030) を追加ベンダ情報：レッドハット (Bug 1053504) を追加 [2014年03月13日] ベンダ情報：レッドハット (RHSA-2014:0134) を追加ベンダ情報：レッドハット (RHSA-2014:0135) を追加 [2014年03月19日] ベンダ情報：ヒューレット・パッカード (HPSBUX02972 SSRT101454) を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02973 SSRT101455) を追加 [2014年06月25日] ベンダ情報：IBM (N1020003) を追加ベンダ情報：IBM (1659761) を追加ベンダ情報：IBM (1662968) を追加ベンダ情報：IBM (1669498) を追加ベンダ情報：IBM (1670264) を追加ベンダ情報：IBM (1670805) を追加ベンダ情報：IBM (1671008) を追加ベンダ情報：IBM (1671348) を追加ベンダ情報：IBM (1672835) を追加ベンダ情報：IBM (1675223) を追加ベンダ情報：IBM (1663938) を追加ベンダ情報：IBM (1664835) を追加ベンダ情報：IBM (1667143) を追加ベンダ情報：IBM (1672078) を追加ベンダ情報：IBM (1673091) を追加ベンダ情報：IBM (1675205) を追加ベンダ情報：IBM (1672384) を追加 [2015年03月17日] 影響を受けるシステム：内容を更新	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-0424

Summary	Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418.
Publication Date	Jan. 16, 2014, 1:08 a.m.
Registration Date	Jan. 26, 2021, 3:04 p.m.
Last Update	Nov. 21, 2024, 11:02 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:oracle:jre:1.7.0:update45::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:1.6.0:update65::::::
cpe:2.3:a:oracle:jre:1.6.0:update65::::::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html
2	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html
3	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html
4	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html
5	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html
6	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html
7	http://marc.info/?l=bugtraq&m=139402697611681&w=2
8	http://marc.info/?l=bugtraq&m=139402697611681&w=2
9	http://marc.info/?l=bugtraq&m=139402697611681&w=2
10	http://marc.info/?l=bugtraq&m=139402697611681&w=2
11	http://marc.info/?l=bugtraq&m=139402749111889&w=2
12	http://marc.info/?l=bugtraq&m=139402749111889&w=2
13	http://marc.info/?l=bugtraq&m=139402749111889&w=2
14	http://marc.info/?l=bugtraq&m=139402749111889&w=2
15	http://osvdb.org/102004
16	http://osvdb.org/102004
17	http://rhn.redhat.com/errata/RHSA-2014-0030.html
18	http://rhn.redhat.com/errata/RHSA-2014-0030.html
19	http://rhn.redhat.com/errata/RHSA-2014-0134.html
20	http://rhn.redhat.com/errata/RHSA-2014-0134.html
21	http://rhn.redhat.com/errata/RHSA-2014-0135.html
22	http://rhn.redhat.com/errata/RHSA-2014-0135.html
23	http://secunia.com/advisories/56485
24	http://secunia.com/advisories/56485
25	http://secunia.com/advisories/56535
26	http://secunia.com/advisories/56535
27	http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Vendor Advisory
28	http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Vendor Advisory
29	http://www.securityfocus.com/bid/64758
30	http://www.securityfocus.com/bid/64758
31	http://www.securityfocus.com/bid/64919
32	http://www.securityfocus.com/bid/64919
33	http://www.securitytracker.com/id/1029608
34	http://www.securitytracker.com/id/1029608
35	https://access.redhat.com/errata/RHSA-2014:0414
36	https://access.redhat.com/errata/RHSA-2014:0414
37	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777
38	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777

Common Vulnerabilities List